Technical Field
This disclosure relates generally to information security on network-connected appliances.
Background of the Related Art
Security threats are continually evolving. With the rapid growth of cutting-edge web applications and increased file sharing, activities that may have been considered harmless in the past could become potential openings for attackers. Traditional security means, such as anti-malware software and firewalls, have become easier to bypass. Thus, there is a significant need for more advanced, proactive threat protection that can help provide comprehensive security against new and emerging threats.
Network-connected, non-display devices (“appliances) are ubiquitous in many computing environments. For example, appliances built purposely for performing traditional middleware service oriented architecture (SOA) functions are prevalent across certain computer environments. SOA middleware appliances may simplify, help secure or accelerate XML and Web services deployments while extending an existing SOA infrastructure across an enterprise. The utilization of middleware-purposed hardware and a lightweight middleware stack can address the performance burden experienced by conventional software solutions. In addition, the appliance form-factor provides a secure, consumable packaging for implementing middleware SOA functions. One particular advantage that these types of devices provide is to offload processing from back-end systems. To this end, it is well-known to use such middleware devices to perform computationally-expensive processes related to network security. For example, network intrusion prevention system (IPS) appliances are designed to sit at the entry points to an enterprise network to protect business-critical assets, such as internal networks, servers, endpoints and applications, from malicious threats.
The use of Secure Sockets Layer (SSL) and/or Transport Layer Security (TLS)-based encryption for network communications generally inhibits the ability to identify and mitigate threat traffic from within the network. It is now estimated that upwards of two-thirds or more of all business network traffic is conveyed over SSL/TLS. This means that organizations relying on network communications typically are unable to protect (from the network) the endpoints in their enterprise that may be susceptible to such threats. Indeed, the vast majority of SSL/TLS communications use only server authentication, i.e., the server is authenticated via the SSL/TLS protocols to the client, but the client is unauthenticated with respect to the server. This authentication asymmetry provides the opportunity for a process to interpose itself between client and server in such a way as to enable decryption of communications and inspection of its contents. Such a “man-in-the-middle” (MITM) process may be malicious, or it may be used for legitimate reasons, such as packet inspection (for threat detection).
Thus, it is known to provide a transparent (MITM) proxy between a client and a server that can be configured to create and manage two separate SSL/TLS sessions, one as the client to the target server, and another as a server to the initiating client. The intermediate proxy thus appears to the server as a client, and to the client as the intended server. Communications initiated from the client, and any responses received from the server, theoretically are then available for inspection and subsequent action. Current transparent proxies that operate in this manner, however, require that once a session is “taken over,” the inspection process must continue until session termination. This is true even in the scenario where the MITM determines (early-on) that it should not perform (or should cease performing) an inspection. In one example scenario, the MITM intercepts the traffic and, as it is setting up the two separate SSL/TLS sessions, it learns (e.g., from receipt of the server certificate) that interception should not occur (e.g., because the server certificate matches some policy restricting interception). In this scenario, however, the MITM cannot simply abandon the TLS connection(s) that it is setting up. As a consequence, systems that employ this type of MITM inspection often consume system resources unnecessarily for the vast bulk of the traffic so handled. This inability to abandon the TLS connection is highly inefficient.
There remains a need to provide for an intermediary (whether a proxy or otherwise) that can transparently de-insert itself from the client-server path without interfering or signaling this operation to either end of the session.